e85d72
diff -up openssl-1.1.0g/crypto/conf/conf_api.c.secure-getenv openssl-1.1.0g/crypto/conf/conf_api.c
e85d72
--- openssl-1.1.0g/crypto/conf/conf_api.c.secure-getenv	2017-11-02 15:29:02.000000000 +0100
e85d72
+++ openssl-1.1.0g/crypto/conf/conf_api.c	2017-11-03 16:12:31.826265323 +0100
510bcc
@@ -9,6 +9,8 @@
510bcc
 
510bcc
 /* Part of the code in here was originally in conf.c, which is now removed */
510bcc
 
510bcc
+/* for secure_getenv */
510bcc
+#define _GNU_SOURCE
510bcc
 #include <stdlib.h>
510bcc
 #include <string.h>
510bcc
 #include <openssl conf.h="">
510bcc
@@ -82,7 +84,7 @@ char *_CONF_get_string(const CONF *conf,
510bcc
             if (v != NULL)
510bcc
                 return (v->value);
510bcc
             if (strcmp(section, "ENV") == 0) {
510bcc
-                p = getenv(name);
510bcc
+                p = secure_getenv(name);
510bcc
                 if (p != NULL)
510bcc
                     return (p);
510bcc
             }
510bcc
@@ -95,7 +97,7 @@ char *_CONF_get_string(const CONF *conf,
510bcc
         else
510bcc
             return (NULL);
510bcc
     } else
510bcc
-        return (getenv(name));
510bcc
+        return (secure_getenv(name));
510bcc
 }
510bcc
 
510bcc
 static unsigned long conf_value_hash(const CONF_VALUE *v)
e85d72
diff -up openssl-1.1.0g/crypto/conf/conf_mod.c.secure-getenv openssl-1.1.0g/crypto/conf/conf_mod.c
e85d72
--- openssl-1.1.0g/crypto/conf/conf_mod.c.secure-getenv	2017-11-02 15:29:02.000000000 +0100
e85d72
+++ openssl-1.1.0g/crypto/conf/conf_mod.c	2017-11-03 16:12:31.827265347 +0100
510bcc
@@ -7,6 +7,8 @@
510bcc
  * https://www.openssl.org/source/license.html
510bcc
  */
510bcc
 
510bcc
+/* for secure_getenv */
510bcc
+#define _GNU_SOURCE
510bcc
 #include <stdio.h>
510bcc
 #include <ctype.h>
510bcc
 #include <openssl crypto.h="">
510bcc
@@ -478,7 +480,7 @@ char *CONF_get1_default_config_file(void
510bcc
     char *file;
510bcc
     int len;
510bcc
 
510bcc
-    file = getenv("OPENSSL_CONF");
510bcc
+    file = secure_getenv("OPENSSL_CONF");
510bcc
     if (file)
510bcc
         return OPENSSL_strdup(file);
510bcc
 
e85d72
diff -up openssl-1.1.0g/crypto/engine/eng_list.c.secure-getenv openssl-1.1.0g/crypto/engine/eng_list.c
e85d72
--- openssl-1.1.0g/crypto/engine/eng_list.c.secure-getenv	2017-11-02 15:29:03.000000000 +0100
e85d72
+++ openssl-1.1.0g/crypto/engine/eng_list.c	2017-11-03 16:12:31.827265347 +0100
510bcc
@@ -13,6 +13,8 @@
510bcc
  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
510bcc
  */
510bcc
 
510bcc
+/* for secure_getenv */
510bcc
+#define _GNU_SOURCE
510bcc
 #include "eng_int.h"
510bcc
 
510bcc
 /*
510bcc
@@ -322,7 +324,7 @@ ENGINE *ENGINE_by_id(const char *id)
510bcc
      * Prevent infinite recursion if we're looking for the dynamic engine.
510bcc
      */
510bcc
     if (strcmp(id, "dynamic")) {
510bcc
-        if ((load_dir = getenv("OPENSSL_ENGINES")) == 0)
510bcc
+        if ((load_dir = secure_getenv("OPENSSL_ENGINES")) == 0)
510bcc
             load_dir = ENGINESDIR;
510bcc
         iterator = ENGINE_by_id("dynamic");
510bcc
         if (!iterator || !ENGINE_ctrl_cmd_string(iterator, "ID", id, 0) ||
e85d72
diff -up openssl-1.1.0g/crypto/rand/randfile.c.secure-getenv openssl-1.1.0g/crypto/rand/randfile.c
e85d72
--- openssl-1.1.0g/crypto/rand/randfile.c.secure-getenv	2017-11-02 15:29:03.000000000 +0100
e85d72
+++ openssl-1.1.0g/crypto/rand/randfile.c	2017-11-03 16:12:31.827265347 +0100
510bcc
@@ -7,6 +7,8 @@
510bcc
  * https://www.openssl.org/source/license.html
510bcc
  */
510bcc
 
510bcc
+/* for secure_getenv */
510bcc
+#define _GNU_SOURCE
510bcc
 #include "internal/cryptlib.h"
510bcc
 
510bcc
 #include <errno.h>
e85d72
@@ -317,10 +319,10 @@ const char *RAND_file_name(char *buf, si
510bcc
     if (OPENSSL_issetugid() != 0) {
510bcc
         use_randfile = 0;
510bcc
     } else {
510bcc
-        s = getenv("RANDFILE");
510bcc
+        s = secure_getenv("RANDFILE");
510bcc
         if (s == NULL || *s == '\0') {
510bcc
             use_randfile = 0;
510bcc
-            s = getenv("HOME");
510bcc
+            s = secure_getenv("HOME");
510bcc
         }
510bcc
     }
510bcc
 #endif
e85d72
diff -up openssl-1.1.0g/crypto/x509/by_dir.c.secure-getenv openssl-1.1.0g/crypto/x509/by_dir.c
e85d72
--- openssl-1.1.0g/crypto/x509/by_dir.c.secure-getenv	2017-11-02 15:29:04.000000000 +0100
e85d72
+++ openssl-1.1.0g/crypto/x509/by_dir.c	2017-11-03 16:12:31.827265347 +0100
510bcc
@@ -7,6 +7,8 @@
510bcc
  * https://www.openssl.org/source/license.html
510bcc
  */
510bcc
 
510bcc
+/* for secure_getenv */
510bcc
+#define _GNU_SOURCE
510bcc
 #include <stdio.h>
510bcc
 #include <time.h>
510bcc
 #include <errno.h>
e85d72
@@ -78,7 +80,7 @@ static int dir_ctrl(X509_LOOKUP *ctx, in
510bcc
     switch (cmd) {
510bcc
     case X509_L_ADD_DIR:
510bcc
         if (argl == X509_FILETYPE_DEFAULT) {
510bcc
-            dir = (char *)getenv(X509_get_default_cert_dir_env());
510bcc
+            dir = (char *)secure_getenv(X509_get_default_cert_dir_env());
510bcc
             if (dir)
510bcc
                 ret = add_cert_dir(ld, dir, X509_FILETYPE_PEM);
510bcc
             else
e85d72
diff -up openssl-1.1.0g/crypto/x509/by_file.c.secure-getenv openssl-1.1.0g/crypto/x509/by_file.c
e85d72
--- openssl-1.1.0g/crypto/x509/by_file.c.secure-getenv	2017-11-02 15:29:04.000000000 +0100
e85d72
+++ openssl-1.1.0g/crypto/x509/by_file.c	2017-11-03 16:14:13.230649686 +0100
510bcc
@@ -7,6 +7,8 @@
510bcc
  * https://www.openssl.org/source/license.html
510bcc
  */
510bcc
 
510bcc
+/* for secure_getenv */
510bcc
+#define _GNU_SOURCE
510bcc
 #include <stdio.h>
510bcc
 #include <time.h>
510bcc
 #include <errno.h>
510bcc
@@ -47,7 +49,7 @@ static int by_file_ctrl(X509_LOOKUP *ctx
510bcc
     switch (cmd) {
510bcc
     case X509_L_FILE_LOAD:
510bcc
         if (argl == X509_FILETYPE_DEFAULT) {
e85d72
-            file = getenv(X509_get_default_cert_file_env());
e85d72
+            file = secure_getenv(X509_get_default_cert_file_env());
510bcc
             if (file)
510bcc
                 ok = (X509_load_cert_crl_file(ctx, file,
510bcc
                                               X509_FILETYPE_PEM) != 0);